mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-22 23:21:08 +02:00
0660ea6fac
* Update README Let contributors know that docs will now be located in UDR * Add comments to each mdx doc Comment has been added to all mdx docs that are not partials * chore: added changelog changelog check failure * wip: removed changelog * Fix content errors * Doc spacing * Update website/content/docs/deploy/kubernetes/vso/helm.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> --------- Co-authored-by: jonathanfrappier <92055993+jonathanfrappier@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
130 lines
4.8 KiB
Plaintext
130 lines
4.8 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Redis database secrets engine
|
|
description: >-
|
|
Redis is one of the supported plugins for the database secrets engine.
|
|
This plugin generates database credentials dynamically based on configured
|
|
roles for the Redis database.
|
|
---
|
|
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.
|
|
|
|
# Redis database secrets engine
|
|
|
|
Redis is one of the supported plugins for the database secrets engine. This
|
|
plugin generates database credentials dynamically based on configured roles for
|
|
the Redis database, and also supports [Static Roles](/vault/docs/secrets/databases#static-roles).
|
|
|
|
See the [database secrets engine](/vault/docs/secrets/databases) docs for
|
|
more information about setting up the database secrets engine.
|
|
|
|
## Capabilities
|
|
|
|
| Plugin Name | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
|
|
| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
|
|
| `redis-database-plugin` | Yes | Yes | Yes | No |
|
|
|
|
## Setup
|
|
|
|
1. Enable the database secrets engine if it is not already enabled:
|
|
|
|
```shell-session
|
|
$ vault secrets enable database
|
|
Success! Enabled the database secrets engine at: database/
|
|
```
|
|
|
|
By default, the secrets engine will enable at the name of the engine. To
|
|
enable the secrets engine at a different path, use the `-path` argument.
|
|
|
|
1. Configure Vault with the proper plugin and connection configuration:
|
|
|
|
```shell-session
|
|
$ vault write database/config/my-redis-database \
|
|
plugin_name="redis-database-plugin" \
|
|
host="localhost" \
|
|
port=6379 \
|
|
tls=true \
|
|
ca_cert="$CACERT" \
|
|
username="user" \
|
|
password="pass" \
|
|
allowed_roles="my-*-role"
|
|
```
|
|
|
|
1. You should consider rotating the admin password. Note that if you do, the
|
|
new password will never be made available through Vault, so you should
|
|
create a Vault-specific database admin user for this.
|
|
|
|
```shell-session
|
|
vault write -force database/rotate-root/my-redis-database
|
|
```
|
|
|
|
## Usage
|
|
|
|
After the secrets engine is configured, write dynamic and static roles
|
|
to Vault to enable generating credentials.
|
|
|
|
### Dynamic roles
|
|
|
|
1. Configure a dynamic role that maps a name in Vault to a JSON string
|
|
containing the Redis ACL rules, which are either documented [here](https://redis.io/commands/acl-cat) or in the output
|
|
of the `ACL CAT` Redis command.
|
|
|
|
```shell-session
|
|
$ vault write database/roles/my-dynamic-role \
|
|
db_name="my-redis-database" \
|
|
creation_statements='["+@admin"]' \
|
|
default_ttl="5m" \
|
|
max_ttl="1h"
|
|
Success! Data written to: database/roles/my-dynamic-role
|
|
```
|
|
|
|
Note that if a creation_statement is not provided the user account will
|
|
default to a read only user, `'["~*", "+@read"]'` that can read any key.
|
|
|
|
1. Generate a new set of credentials by reading from the `/creds` endpoint with the name
|
|
of the role:
|
|
|
|
```shell-session
|
|
$ vault read database/creds/my-dynamic-role
|
|
Key Value
|
|
--- -----
|
|
lease_id database/creds/my-dynamic-role/OxCTXJcxQ2F4lReWPjbezSnA
|
|
lease_duration 5m
|
|
lease_renewable true
|
|
password dACqHsav6-attdv1glGZ
|
|
username V_TOKEN_MY-DYNAMIC-ROLE_YASUQUF3GVVD0ZWTEMK4_1608481717
|
|
```
|
|
|
|
### Static roles
|
|
|
|
1. Configure a static role that maps a name in Vault to an existing Redis
|
|
user.
|
|
|
|
```shell-session
|
|
$ vault write database/static-roles/my-static-role \
|
|
db_name="my-redis-database" \
|
|
username="my-existing-redis-user" \
|
|
rotation_period=5m
|
|
Success! Data written to: database/static-roles/my-static-role
|
|
```
|
|
|
|
1. Retrieve the credentials from the `/static-creds` endpoint:
|
|
|
|
```shell-session
|
|
$ vault read database/static-creds/my-static-role
|
|
Key Value
|
|
--- -----
|
|
last_vault_rotation 2020-12-20T10:39:49.647822-06:00
|
|
password ylKNgqa3NPVAioBf-0S5
|
|
rotation_period 5m
|
|
ttl 4m39s
|
|
username my-existing-redis-user
|
|
```
|
|
|
|
## API
|
|
|
|
The full list of configurable options can be seen in the [Redis Database Plugin API](/vault/api-docs/secret/databases/redis) page.
|
|
|
|
For more information on the database secrets engine's HTTP API please see the [Database Secrets Engine API](/vault/api-docs/secret/databases) page.
|